Browser extensions have access to everything you do in your browser — every page you visit, every form you fill in, every credential you enter. Most are legitimate tools. Some are data-harvesting malware. And most businesses have no visibility into what extensions their staff are running.
In 2023, a batch of Chrome extensions posing as VPN, ad-blocking, and screenshot tools were found to contain data-harvesting code that exfiltrated browser history, cookies, and form data — including credentials entered in business applications — to attacker-controlled servers. The extensions had collectively been installed millions of times and were available in the Chrome Web Store for months before detection.
What Browser Extensions Can Access
Browser extension permissions are often granted wholesale without reading them. A "read and change all your data on the websites you visit" permission — which is the standard permission for extensions that need to modify web page content — means the extension can see every page you load in the browser, read every form field including username and password fields, and potentially modify page content (to add phishing elements or redirect links).
Extensions with this permission level can exfiltrate business application sessions, read email content as you browse it, capture credentials entered on login pages, and monitor everything you type in browser-accessible applications. This is not hypothetical — it's what data-harvesting extensions actually do.
High-Risk Extension Categories
Extensions in certain categories are disproportionately likely to be malicious or privacy-invasive: coupon and discount finders, free VPN tools, screenshot and screen recording tools, PDF converters and "free" office tools, and "productivity enhancers" from unfamiliar developers. These categories offer a pretext for requesting broad permissions while providing enough legitimate functionality to avoid obvious suspicion.
Managing Extension Risk in a Business Environment
Microsoft Intune and Endpoint Manager allow IT administrators to enforce browser extension policies on managed devices — whitelisting approved extensions (LastPass, 1Password, Grammarly, internal tools) and blocking installation of extensions not on the approved list. This is the most effective control for environments where endpoint management is in place.
For environments without full endpoint management, the minimum approach is: an explicit policy that staff should not install browser extensions on work devices without IT approval, regular audits of installed extensions via IT tooling, and staff education about the specific risks of browser extensions.
Browser extensions live inside your browser's security context with access to everything you do there. Treating extension installation with the same scrutiny as software installation is appropriate — because that's functionally what it is.
